potiuk opened a new pull request, #3324:
URL: https://github.com/apache/brpc/pull/3324
## Add the Apache bRPC threat model + security-model discoverability
This lands the **bRPC threat model** in-repo and wires up the discoverability
chain so automated security tooling (and human triagers) can mechanically
find
it:
- `THREAT_MODEL.md` — the threat model, **first drafted by the ASF Security
Team and revised by @wwbmmm (Weibing Wang)** on the PMC side. This PR puts
that reviewed model under version control in the repo rather than in a
gist.
- `SECURITY.md` — points reporters at the threat model + the ASF security
reporting process.
- `AGENTS.md` — a `Security` section linking `SECURITY.md → THREAT_MODEL.md`
so an automated reviewer can follow the chain.
### This is a draft for the PMC to finalize — review welcome here
@wwbmmm already did a substantial revision pass (streamlined the original
draft, answered the §14 open questions). Landing it in-repo as a PR is the
"one more look" before it's final — please refine directly here.
Two simplifications @wwbmmm flagged are best done as review on this PR (left
to
the author rather than applied unilaterally):
- **Collapse the remaining redundancy** — e.g. the `-immutable_flags` /
`/flags` point currently appears in the §5a config table, the §5a
insecure-default summary, §9 D13, §11 M14, and §14 Q46. Decide which homes
are load-bearing and trim the rest.
- **Keep it at the trust-boundary level.** Favour high-level statements of
how
trust boundaries are defined and what security properties bRPC does / does
not provide, over code-level detail that drifts across bRPC versions — so
the
document stays accurate and maintainable as the code evolves. (The §5a
tables
already carry "example, not a complete list — analyze the latest code"
disclaimers in that spirit.)
The model is version-bound (based on `master` around 2026-05-21); reports
should be triaged against the model for the corresponding release, and the
document re-bound on each release.
This is part of an automated agentic security-scan pilot the ASF Security
team
is running; a discoverable, in-repo threat model lets the scan focus on real
issues and suppress the by-design ones. No project source is touched.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
